CVE-2021-32791 - CVE House
Back to Database
Status published Medium CVE-2021-32791

Hardcoded static IV and AAD with a reused key in AES GCM encryption in mod_auth_openidc

Vulnerability Description

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9, the AES GCM encryption in mod_auth_openidc uses a static IV and AAD. It is important to fix because this creates a static nonce and since aes-gcm is a stream cipher, this can lead to known cryptographic issues, since the same key is being reused. From 2.4.9 onwards this has been patched to use dynamic values through usage of cjose AES encryption routines.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-32791

Credits & Attribution

No credits recorded in the NVD database.

References

More from zmartzone

View All →
CVE-2022-23527
Open Redirect in oidc_validate_redirect_url()
Medium 4.7
CVE-2021-39191
URL Redirection to Untrusted Site ('Open Redirect') in mod_auth_openidc
Medium 4.7
CVE-2021-32792
XSS vulnerability when using OIDCPreservePost On in mod_auth_openidc
Low 3.1
CVE-2021-32786
Open Redirect in oidc_validate_redirect_url()
Medium 4.7
CVE-2021-32785
Format string bug in the Redis cache implementation
Medium 5.3

Affected Vendor

Affected Software

mod_auth_openidc
Vulnerable Versions:
< 2.4.9

Timeline

Official Publish: July 26th, 2021
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-323 CWE-330

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.